utmp -- System Administration

File that notes login events that are active
/etc/utmp

File /etc/utmp notes every login event  that is active -- that is, when the
user has logged  in and has not yet logged  out.  It is read by the command
who to display the users who are now logged into your system.

utmp records  each active login  event as a  record of type  utmp, which is
defined in  header file  <utmp>. For  details, see the  Lexicon entry
utmp.h.

File /usr/adm/wtmp  records every login event that  has concluded.  You can
comb this file to trace which user have logged onto your system, and when.

See Also

Adminstering COHERENT,
utmp.h,
wtmp

© 2012 by Stephen A. Ness